California Privacy Laws and Implications For #OOH
As states strengthen consumer privacy protections, California remains at the forefront, and OAAA outlines implications for OOH data use, measurement, and AI-generated advertising.
California remains at the forefront of consumer privacy legislation, and the out-of-home advertising industry is watching closely. As states strengthen protections governing how businesses collect, use and manage personal data, evolving laws could affect how OOH companies use data, measure campaign performance and connect OOH with broader marketing strategies. OOH reaches people in the physical world through shared experiences, and as the industry embraces new technologies and more sophisticated measurement, understanding the privacy landscape is increasingly important. California's approach has helped shape privacy legislation nationwide, with 23 states now having enacted comprehensive consumer privacy laws. For a small business running signage on a single screen, the rules governing customer data are tightening in 23 states, and that touches any campaign mixing physical screens with digital targeting or measurement. Owners relying on local audience data, third-party data partners or AI-generated creative should expect new disclosure and consent obligations to ripple into their media plans.
California's Privacy Framework and National Ripple Effects
In 2018, California became the first state to enact a comprehensive consumer privacy law with the California Consumer Privacy Act (CCPA). The state subsequently established an independent regulatory agency to oversee enforcement and expanded its privacy framework through additional legislation. These measures strengthened consumer rights, established a public data broker registry and created new mechanisms for individuals to control how their personal information is collected, shared and deleted.
In 2026, Alabama, Louisiana, Oklahoma and Vermont joined the growing number of states advancing comprehensive consumer privacy legislation, while other states introduced updates and amendments to existing laws, further expanding the regulatory landscape.
California continued to lead the conversation during its most recent legislative session, with Governor Gavin Newsom signing or vetoing more than 300 bills, including several measures addressing consumer privacy and artificial intelligence. Among the new laws are additional protections for social media users under the age of 16, including restrictions on how platforms collect and use consumer profile data for targeted advertising.
California and Pennsylvania also enacted new AI-related legislation, including requirements addressing the use of digitally generated performers in advertising. Similar to legislation recently adopted in New York, these measures introduce new disclosure considerations for advertisers using AI-generated voices, actors and other synthetic representations.
Other proposals did not advance. Governor Newsom vetoed legislation that would have prohibited companies subject to the CCPA from selling or sharing sensitive personal information, citing existing consumer opt-out protections and concerns about the proposal's broad application. Meanwhile, other states are taking different approaches. Several have restricted the sale of certain categories of sensitive personal information, including precise geolocation data. Maryland and New Jersey have gone further, prohibiting the sale of sensitive personal information even with consumer consent.
Implications for Out-of-Home Advertising
The OAAA says OOH companies should pay particular attention to how evolving state requirements may affect several areas: location and audience data, with restrictions on the collection, sale and use of precise geolocation and other sensitive personal information; third-party data partnerships, with new requirements governing data brokers and access to consumer information; integrated campaigns and measurement, with privacy considerations for campaigns connecting OOH exposure with digital engagement, attribution and other performance metrics; digital operations, with compliance obligations related to company websites and consumer data practices; and AI-generated advertising, with emerging disclosure requirements for synthetic performers and AI-generated creative content.
Although not every new law will directly affect OOH, understanding where legislation intersects with industry practices is essential as the medium continues to evolve. Looking ahead to 2027, the OAAA expects continued attention to consumer privacy, data usage and AI-generated advertising as state legislatures reconvene and regulators implement existing laws. The OAAA remains focused on helping members understand the changing regulatory environment and its potential implications for the industry, monitoring legislative and regulatory developments, identifying emerging issues and providing members with the information they need to navigate new requirements.